3 ms·
True. A percentage of the union of Adobe and Disqus users will use the same password for both services.
by Asdfjgori 13y ago
True. A percentage of the union of Adobe and Disqus users will use the same password for both services.
- jessaustin 13y agoBut if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?
- Asdfjgori 13y agoYou don't want to try 150 million Adobe logins on Disqus. You want to identify which ones to test first.
- jessaustin 13y agoMaybe I'm being dense this morning... if I were in the Adobe 150M, some criminals would already have my email address, right? How does getting Disqus's hash of it help them out?
- gabriel34 13y agoNot being dense at all, it's a valid point, but crossing both leaks helps them find out quickly which logins and password combos to try at disqus, and which accounts will be compromised.
- Asdfjgori 13y agoBy linking your Disqus comments to your e-mail. For example your comments on sexual preference blogs, political blogs etc. Mapping your life, possibly opening up for blackmail.
- jessaustin 13y agoWell I guess risk profiles vary. I'm certainly more worried about criminals having the access they need to reset my creds with various services, than about them knowing my oddball political opinions. I still don't see how this Disqus issue makes Adobe worse, although admittedly any big list of email addresses (like Adobe) makes this worse.
- im3w1l 13y agoMaybe you remembered to change your email password, but forgot to change your disqus password.